@duckcodeailabs/dql-agent 1.14.0 → 1.14.2

package/dist/agentic/turn-plan.js

@@ -0,0 +1,108 @@
+/**
+ * One structured planning call, made before the analyst loop starts acting.
+ *
+ * The loop can already sequence its own tools, so this is not what makes it
+ * work — it is what makes it legible. Without a plan the trace can only emit a
+ * hardcoded "working on it" string, and the user waits in silence exactly as
+ * they do today. With one, the trace names what the agent intends to establish
+ * before it establishes it, which is the difference between a progress bar and
+ * an analyst thinking out loud.
+ *
+ * It is therefore strictly optional: any failure, timeout, or malformed reply
+ * returns `undefined` and the loop proceeds exactly as it would have. A
+ * planning call that blocked an answer would be a bad trade.
+ */
+const PLAN_PROMPT = `You are planning one analytical turn. Do not answer the question.
+Reply with ONLY a JSON object:
+{"restatement": "<the question in your own words, one sentence>",
+ "mustEstablish": ["<fact to verify before writing SQL>", "..."],
+ "openingTool": "<the tool you will call first>"}
+List at most four things under mustEstablish. Each must be something a tool can
+check — a metric exists, a column exists, a value appears in a column, two
+members are compatible. Never list something you would assume.`;
+/** Pull the first JSON object out of a reply that may be fenced or prefaced. */
+function extractJsonObject(raw) {
+    const trimmed = raw.trim();
+    const start = trimmed.indexOf('{');
+    if (start < 0)
+        return undefined;
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    for (let i = start; i < trimmed.length; i += 1) {
+        const char = trimmed[i];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (char === '\\') {
+            escaped = true;
+            continue;
+        }
+        if (char === '"') {
+            inString = !inString;
+            continue;
+        }
+        if (inString)
+            continue;
+        if (char === '{')
+            depth += 1;
+        else if (char === '}') {
+            depth -= 1;
+            if (depth === 0) {
+                try {
+                    return JSON.parse(trimmed.slice(start, i + 1));
+                }
+                catch {
+                    return undefined;
+                }
+            }
+        }
+    }
+    return undefined;
+}
+export function parseAnalystTurnPlan(raw, toolNames = []) {
+    const parsed = extractJsonObject(raw);
+    if (!parsed || typeof parsed !== 'object')
+        return undefined;
+    const record = parsed;
+    const restatement = typeof record.restatement === 'string' ? record.restatement.trim() : '';
+    if (!restatement)
+        return undefined;
+    const mustEstablish = Array.isArray(record.mustEstablish)
+        ? record.mustEstablish
+            .filter((entry) => typeof entry === 'string' && entry.trim().length > 0)
+            .map((entry) => entry.trim())
+            .slice(0, 4)
+        : [];
+    // Only echo a tool the model can actually call. A hallucinated name in the
+    // trace would promise the user a step that never happens.
+    const openingTool = typeof record.openingTool === 'string'
+        && toolNames.includes(record.openingTool.trim())
+        ? record.openingTool.trim()
+        : undefined;
+    return { restatement, mustEstablish, ...(openingTool ? { openingTool } : {}) };
+}
+export async function planAnalystTurn(provider, question, toolNames, options = {}) {
+    const timeoutMs = options.timeoutMs ?? 2_500;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    const onAbort = () => controller.abort();
+    options.signal?.addEventListener('abort', onAbort, { once: true });
+    try {
+        const raw = await provider.generate([
+            { role: 'system', content: `${PLAN_PROMPT}\n\nTools available: ${toolNames.join(', ')}` },
+            { role: 'user', content: question },
+        ], { signal: controller.signal });
+        return parseAnalystTurnPlan(raw, toolNames);
+    }
+    catch {
+        // Planning is decoration on a working loop. Never let it fail the turn.
+        return undefined;
+    }
+    finally {
+        clearTimeout(timer);
+        options.signal?.removeEventListener('abort', onAbort);
+    }
+}
+//# sourceMappingURL=turn-plan.js.map

package/dist/agentic/turn-plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"turn-plan.js","sourceRoot":"","sources":["../../src/agentic/turn-plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAkBH,MAAM,WAAW,GAAG;;;;;;;+DAO2C,CAAC;AAEhE,gFAAgF;AAChF,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,OAAO,EAAE,CAAC;YAAC,OAAO,GAAG,KAAK,CAAC;YAAC,SAAS;QAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAChD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAAC,QAAQ,GAAG,CAAC,QAAQ,CAAC;YAAC,SAAS;QAAC,CAAC;QACrD,IAAI,QAAQ;YAAE,SAAS;QACvB,IAAI,IAAI,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aACxB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACtB,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACjD,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,YAA+B,EAAE;IACjF,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC;QACvD,CAAC,CAAC,MAAM,CAAC,aAAa;aACjB,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;aACxF,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC,CAAC,EAAE,CAAC;IACP,2EAA2E;IAC3E,0DAA0D;IAC1D,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;WACrD,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAChD,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE;QAC3B,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAsB,EACtB,QAAgB,EAChB,SAA4B,EAC5B,UAAwD,EAAE;IAE1D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACzC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,CACjC;YACE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,WAAW,wBAAwB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACzF,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE;SACpC,EACD,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAC9B,CAAC;QACF,OAAO,oBAAoB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;AACH,CAAC"}

package/dist/agentic/value-probe.d.ts

@@ -0,0 +1,89 @@
+/**
+ * `search_values` — bind a literal the user named to a real column value.
+ *
+ * The recorded highest-severity defect in this program: asking about a specific
+ * member returned every row instead of that member's, and the narration then
+ * described the truncated result as if the member were absent. The chain was
+ * `runtime_value_index` empty -> no member grounding -> empty filters -> plan
+ * froze filterless -> 200 of 500 rows -> "no such customer".
+ *
+ * The persisted index was deleted for a good reason (SEC-003: warehouse cell
+ * values must not sit in a rebuildable metadata database). The fix is not to
+ * bring it back but to look the value up ON DEMAND, bounded, and only in columns
+ * a project has agreed may be searched.
+ *
+ * Two independent gates, and BOTH must pass:
+ *   1. a hard deny-list that no configuration can override — secrets and
+ *      free-text payloads are never probed, however a project is set up
+ *   2. an allow-list of column-name shapes that plausibly hold an identifier
+ *
+ * The deny-list is first and unconditional on purpose. An allow-list alone
+ * eventually admits something it should not, because it grows by exception.
+ */
+import type { AgentToolDefinition } from '../providers/types.js';
+export interface ProbeColumn {
+    name: string;
+    type?: string;
+}
+export interface ProbeRelation {
+    relation: string;
+    columns: ProbeColumn[];
+}
+/**
+ * May this column be probed for a literal?
+ *
+ * Canonical implementation — the host's `isAgentValueProbeColumn` delegates here
+ * so the deny-list has exactly one definition. Two copies of a security rule
+ * drift, and the one that drifts is the one nobody is looking at.
+ */
+export declare function isProbeSafeColumn(column: ProbeColumn): boolean;
+/**
+ * Build a bounded DISTINCT lookup for one column.
+ *
+ * Exact match first, then a prefix match on the longer tokens. Prefix rather
+ * than `%term%`: a leading wildcard cannot use an index, and on a large
+ * dimension table that is the difference between a probe and an outage.
+ */
+export declare function buildValueProbeSql(relation: string, column: string, terms: readonly string[], limit?: number): string | undefined;
+export interface SearchValuesOptions {
+    execute: (sql: string) => Promise<{
+        rows: unknown[];
+    }>;
+    relations: readonly ProbeRelation[];
+    /** Probing is opt-in per project; disabled means the tool reports why. */
+    enabled: boolean;
+    /** Max relations probed per call, so one question cannot scan the warehouse. */
+    maxRelations?: number;
+    /** Hard ceiling across columns, not per relation. Never expose more than this many queries. */
+    maxColumnQueries?: number;
+}
+export type ValueProbeCoverageStatus = 'complete' | 'partial' | 'disabled' | 'budget_exhausted' | 'unknown_relation';
+/**
+ * Redacted coverage is the evidence contract for a value lookup.  It says what
+ * was attempted without leaking query text, warehouse errors, or values that
+ * were not already supplied by the caller.
+ */
+export interface ValueProbeCoverageV1 {
+    version: 1;
+    status: ValueProbeCoverageStatus;
+    queryLimit: number;
+    queriesAttempted: number;
+    relationsRequested: string[];
+    relationsSearched: string[];
+    relationsWithNoSearchableColumn: string[];
+    /** Approved relation/column identifiers that could not form ANSI probe SQL. */
+    relationsWithUnbuildableIdentifier: string[];
+    failedRelations: string[];
+    unknownRelations: string[];
+}
+/** The total maximum value-probe queries a single tool call may issue. */
+export declare const MAX_VALUE_PROBE_COLUMN_QUERIES = 12;
+/**
+ * A tool that answers "does this literal exist, and in which column?".
+ *
+ * Returns the matched VALUES — which is the point, since the loop needs the
+ * exact stored spelling to build a filter — but only from columns that passed
+ * both gates, and only values the caller already named.
+ */
+export declare function buildSearchValuesTool(options: SearchValuesOptions): AgentToolDefinition;
+//# sourceMappingURL=value-probe.d.ts.map

package/dist/agentic/value-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"value-probe.d.ts","sourceRoot":"","sources":["../../src/agentic/value-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAkFD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAY9D;AAoBD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,SAAK,GAAG,MAAM,GAAG,SAAS,CAqB7H;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC,CAAC;IACvD,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,0EAA0E;IAC1E,OAAO,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+FAA+F;IAC/F,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAErH;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,wBAAwB,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,+BAA+B,EAAE,MAAM,EAAE,CAAC;IAC1C,+EAA+E;IAC/E,kCAAkC,EAAE,MAAM,EAAE,CAAC;IAC7C,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,0EAA0E;AAC1E,eAAO,MAAM,8BAA8B,KAAK,CAAC;AAEjD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,mBAAmB,GAAG,mBAAmB,CA2IvF"}

package/dist/agentic/value-probe.js

@@ -0,0 +1,304 @@
+/** Values that must never be probed, whatever the configuration says. */
+/**
+ * Hard deny. No configuration overrides this.
+ *
+ * Three groups, and the reason each is here:
+ *   SECRETS — a probe returns literal values, so one match leaks the secret.
+ *   FREE TEXT — a note or description can contain anything, including all of
+ *     the above, so its shape gives no safety.
+ *   DIRECT AND REGULATED IDENTIFIERS — payment, government, contact, health,
+ *     and compensation fields. A probe over these is a data-protection
+ *     incident even when the query is otherwise correct, and "the model asked
+ *     for it" is not a defence. Added after a live run answered a request for
+ *     credit-card numbers and home addresses from the nearest certified block.
+ *
+ * Deliberately broad. A false deny costs one value lookup; a false allow
+ * cannot be undone once the values have left the warehouse.
+ */
+const DENY_RE = /\b(password|passwd|secret|token|credential|apikey|api key|private key|hash|salt|signature|session|cookie|auth|otp|pin)\b|\b(notes?|comments?|description|message|body|payload|content|remarks?|feedback|reason)\b|\b(ssn|social security|social insurance|sin\b|dob|date of birth|birth date|birthdate|national id|government id|government identifier|tax id|taxpayer id|taxpayer identification|tin\b|itin\b|ein\b|medicare|medicaid|passport|license|licence|driver license|visa|nric|aadhaar)\b|\b(card|cardnumber|card number|credit card|debit card|cvv|cvc|iban|swift|bic|routing|account number|acct|sort code|bank)\b|\b(address|street|postal|postcode|zip|zipcode|latitude|longitude|geo|coordinates?)\b|\b(phone|mobile|telephone|fax|contact number)\b|\b(salary|compensation|wage|payroll|bonus|income|net pay|gross pay)\b|\b(medical|diagnosis|patient|health|insurance|prescription|disability|biometric|fingerprint|race|ethnicity|religion|gender|sexual)\b/;
+/** Email is denied separately: it is an identifier, but also direct PII. */
+const EMAIL_RE = /\bemail\b/;
+/** Name shapes that plausibly identify an entity rather than describe one. */
+const IDENTIFIER_TOKENS = new Set([
+    'account', 'category', 'channel', 'city', 'code', 'country', 'customer',
+    'full', 'id', 'key', 'member', 'name', 'number', 'product', 'region',
+    'segment', 'sku', 'state', 'status', 'subscriber', 'tier', 'type', 'user',
+]);
+/**
+ * Token-level aliases that must remain denied even when a connector exposes
+ * them with underscores, dashes, or camel case rather than the prose phrases
+ * above.  The phrase regex is intentionally broad, but `tax_number` and
+ * `customerBirthDt` never contain the literal phrase "tax id" or "birth
+ * date".  Normalise the identifier into tokens before the allow-list gets a
+ * chance to treat its `number` / `customer` part as a business key.
+ */
+const SENSITIVE_IDENTIFIER_PREFIXES = new Set([
+    'government', 'govt', 'national', 'tax', 'taxpayer',
+]);
+const SENSITIVE_IDENTIFIER_SUFFIXES = new Set([
+    'id', 'identifier', 'number', 'no', 'num',
+]);
+// Connector metadata often elides separators inside an otherwise ordinary
+// entity identifier (for example `customer_taxnumber`). Match only a
+// sensitive alias at the end of the compact identifier: this catches the
+// sensitive suffix without turning `customer_id` or `product_number` into a
+// false positive.
+const COMPACT_SENSITIVE_IDENTIFIER_ALIAS_RE = /(?:taxpayer|tax|government|govt|national)(?:id|identifier|number|no|num)$/;
+const COMPACT_BIRTH_DATE_ALIAS_RE = /(?:birth(?:date|dt|day|dob|on)|dateofbirth|birthday)$/;
+/** Types that can hold a searchable literal. */
+const TEXTUAL_TYPE_RE = /\b(char|character|clob|string|text|uuid|varchar|nvarchar)\b/;
+function tokenize(name) {
+    return new Set(name
+        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+        .replace(/[_\-.]+/g, ' ')
+        .toLowerCase()
+        .split(/\s+/)
+        .filter(Boolean));
+}
+function isSensitiveIdentifierAlias(tokens) {
+    const has = (...values) => values.some((value) => tokens.has(value));
+    const compact = [...tokens].join('');
+    if (COMPACT_SENSITIVE_IDENTIFIER_ALIAS_RE.test(compact) || COMPACT_BIRTH_DATE_ALIAS_RE.test(compact)) {
+        return true;
+    }
+    // `date_of_birth`, `customer_birth_dt`, and `customerDOB` are all direct
+    // personal identifiers despite their otherwise identifier-shaped names.
+    if (has('dob') || (has('birth') && has('date', 'dt', 'day', 'on')))
+        return true;
+    // Treat a government/tax qualifier plus an identifier suffix as sensitive.
+    // This intentionally does not deny ordinary business identifiers such as
+    // `customer_id`, `product_number`, or `order_code`.
+    return has(...SENSITIVE_IDENTIFIER_PREFIXES)
+        && has(...SENSITIVE_IDENTIFIER_SUFFIXES);
+}
+/**
+ * May this column be probed for a literal?
+ *
+ * Canonical implementation — the host's `isAgentValueProbeColumn` delegates here
+ * so the deny-list has exactly one definition. Two copies of a security rule
+ * drift, and the one that drifts is the one nobody is looking at.
+ */
+export function isProbeSafeColumn(column) {
+    const normalized = column.name.replace(/([a-z0-9])([A-Z])/g, '$1 $2').replace(/[_\-.]+/g, ' ').toLowerCase();
+    if (DENY_RE.test(normalized))
+        return false;
+    if (EMAIL_RE.test(normalized))
+        return false;
+    const tokens = tokenize(column.name);
+    if (isSensitiveIdentifierAlias(tokens))
+        return false;
+    if (![...tokens].some((token) => IDENTIFIER_TOKENS.has(token)))
+        return false;
+    const type = column.type?.toLowerCase() ?? '';
+    // An unknown type is allowed: many drivers omit it, and the name gates already
+    // passed. A KNOWN non-textual type is not — a literal cannot live in a float.
+    if (!type)
+        return true;
+    return TEXTUAL_TYPE_RE.test(type);
+}
+/** Escape a single-quoted SQL literal. */
+function sqlLiteral(value) {
+    return `'${value.replace(/'/g, "''")}'`;
+}
+/** Quote an identifier ANSI-style, rejecting anything that is not a plain name. */
+function quoteIdentifier(value) {
+    // Identifiers come from the SCHEMA, never from the user, so anything exotic
+    // here means a caller is passing something it should not.
+    if (!/^[A-Za-z_][A-Za-z0-9_$]*$/.test(value))
+        return undefined;
+    return `"${value}"`;
+}
+function quoteRelation(relation) {
+    const parts = relation.split('.').map(quoteIdentifier);
+    return parts.every(Boolean) ? parts.join('.') : undefined;
+}
+/**
+ * Build a bounded DISTINCT lookup for one column.
+ *
+ * Exact match first, then a prefix match on the longer tokens. Prefix rather
+ * than `%term%`: a leading wildcard cannot use an index, and on a large
+ * dimension table that is the difference between a probe and an outage.
+ */
+export function buildValueProbeSql(relation, column, terms, limit = 25) {
+    const quotedRelation = quoteRelation(relation);
+    const quotedColumn = quoteIdentifier(column);
+    if (!quotedRelation || !quotedColumn)
+        return undefined;
+    const cast = `LOWER(CAST(${quotedColumn} AS VARCHAR))`;
+    const predicates = [];
+    for (const term of terms) {
+        const normalized = term.toLowerCase().replace(/\s+/g, ' ').trim();
+        if (!normalized)
+            continue;
+        predicates.push(`${cast} = ${sqlLiteral(normalized)}`);
+        for (const token of normalized.split(' ').filter((part) => part.length >= 4).slice(0, 2)) {
+            predicates.push(`${cast} LIKE ${sqlLiteral(`${token.replace(/[%_\\]/g, '\\$&')}%`)} ESCAPE '\\'`);
+        }
+    }
+    if (predicates.length === 0)
+        return undefined;
+    return [
+        `SELECT DISTINCT CAST(${quotedColumn} AS VARCHAR) AS value`,
+        `FROM ${quotedRelation}`,
+        `WHERE ${quotedColumn} IS NOT NULL AND (${[...new Set(predicates)].slice(0, 8).join(' OR ')})`,
+        `LIMIT ${Math.max(1, Math.min(limit, 50))}`,
+    ].join('\n');
+}
+/** The total maximum value-probe queries a single tool call may issue. */
+export const MAX_VALUE_PROBE_COLUMN_QUERIES = 12;
+/**
+ * A tool that answers "does this literal exist, and in which column?".
+ *
+ * Returns the matched VALUES — which is the point, since the loop needs the
+ * exact stored spelling to build a filter — but only from columns that passed
+ * both gates, and only values the caller already named.
+ */
+export function buildSearchValuesTool(options) {
+    const maxRelations = options.maxRelations ?? 6;
+    const maxColumnQueries = Math.max(1, Math.min(options.maxColumnQueries ?? MAX_VALUE_PROBE_COLUMN_QUERIES, MAX_VALUE_PROBE_COLUMN_QUERIES));
+    return {
+        name: 'search_values',
+        description: 'Check whether a literal the question names (a customer, product, region, status) exists as a value in the data, and get its exact stored spelling. Use it BEFORE filtering on a name, so a filter is built from a real value rather than a guess. Only searches columns approved for value lookup.',
+        inputSchema: {
+            type: 'object',
+            additionalProperties: false,
+            required: ['terms'],
+            properties: {
+                terms: { type: 'array', items: { type: 'string' }, description: 'Literals named in the question, e.g. ["Wesley Jenkins"].' },
+                relations: { type: 'array', items: { type: 'string' }, description: 'Optional relations to restrict the search to.' },
+            },
+        },
+        run: async (args) => {
+            const input = (args && typeof args === 'object' ? args : {});
+            const terms = Array.isArray(input.terms)
+                ? input.terms.filter((term) => typeof term === 'string' && term.trim().length > 0)
+                : [];
+            if (terms.length === 0)
+                return { error: 'Pass the literal(s) to look up, e.g. ["Wesley Jenkins"].' };
+            if (!options.enabled) {
+                // Say WHY, and name the setting. A silent empty result here is what
+                // produced the false-absence defect: the loop concluded the value did
+                // not exist when it had simply never been allowed to look.
+                return {
+                    searched: false,
+                    reason: 'Value lookup is disabled for this project. Enable agent.runtimeValueGrounding in dql.config.json to let DQL confirm a named value before filtering on it.',
+                    matches: [],
+                    coverage: {
+                        version: 1,
+                        status: 'disabled',
+                        queryLimit: maxColumnQueries,
+                        queriesAttempted: 0,
+                        relationsRequested: [],
+                        relationsSearched: [],
+                        relationsWithNoSearchableColumn: [],
+                        relationsWithUnbuildableIdentifier: [],
+                        failedRelations: [],
+                        unknownRelations: [],
+                    },
+                };
+            }
+            const requestedRelations = Array.isArray(input.relations)
+                ? [...new Set(input.relations.filter((r) => typeof r === 'string' && r.trim().length > 0).map((r) => r.trim()))]
+                : [];
+            const wanted = requestedRelations.length > 0
+                ? new Set(requestedRelations.map((relation) => relation.toLowerCase()))
+                : undefined;
+            const knownRelations = new Set(options.relations.map((relation) => relation.relation.toLowerCase()));
+            const unknownRelations = requestedRelations.filter((relation) => !knownRelations.has(relation.toLowerCase()));
+            const matches = [];
+            const searched = [];
+            const skipped = [];
+            const unbuildableRelations = new Set();
+            const failedRelations = new Set();
+            let queriesAttempted = 0;
+            let relationBudgetExceeded = false;
+            let queryBudgetExceeded = false;
+            let relationsConsidered = 0;
+            for (const relation of options.relations) {
+                if (wanted && !wanted.has(relation.relation.toLowerCase()))
+                    continue;
+                if (relationsConsidered >= maxRelations) {
+                    relationBudgetExceeded = true;
+                    break;
+                }
+                relationsConsidered += 1;
+                const safe = relation.columns.filter(isProbeSafeColumn);
+                if (safe.length === 0) {
+                    skipped.push(relation.relation);
+                    continue;
+                }
+                for (const column of safe) {
+                    if (queriesAttempted >= maxColumnQueries) {
+                        queryBudgetExceeded = true;
+                        break;
+                    }
+                    const sql = buildValueProbeSql(relation.relation, column.name, terms);
+                    if (!sql) {
+                        // Metadata identifiers are not automatically executable SQL
+                        // identifiers.  Never turn an unquotable schema name into a
+                        // zero-query "not found" claim.
+                        unbuildableRelations.add(relation.relation);
+                        continue;
+                    }
+                    if (!searched.includes(relation.relation))
+                        searched.push(relation.relation);
+                    queriesAttempted += 1;
+                    try {
+                        const result = await options.execute(sql);
+                        const values = (result.rows ?? [])
+                            .map((row) => (Array.isArray(row) ? row[0] : row?.value))
+                            .filter((value) => typeof value === 'string');
+                        if (values.length > 0)
+                            matches.push({ relation: relation.relation, column: column.name, values });
+                    }
+                    catch {
+                        // One unreadable relation must not fail the whole probe; a permission
+                        // error on a single table is normal in a governed warehouse.
+                        failedRelations.add(relation.relation);
+                    }
+                }
+                if (queryBudgetExceeded)
+                    break;
+            }
+            const complete = unknownRelations.length === 0
+                && failedRelations.size === 0
+                && skipped.length === 0
+                && unbuildableRelations.size === 0
+                && !relationBudgetExceeded
+                && !queryBudgetExceeded;
+            const status = unknownRelations.length > 0
+                ? 'unknown_relation'
+                : queryBudgetExceeded || relationBudgetExceeded
+                    ? 'budget_exhausted'
+                    : complete
+                        ? 'complete'
+                        : 'partial';
+            const coverage = {
+                version: 1,
+                status,
+                queryLimit: maxColumnQueries,
+                queriesAttempted,
+                relationsRequested: requestedRelations,
+                relationsSearched: searched,
+                relationsWithNoSearchableColumn: skipped,
+                relationsWithUnbuildableIdentifier: [...unbuildableRelations],
+                failedRelations: [...failedRelations],
+                unknownRelations,
+            };
+            return {
+                searched: searched.length > 0,
+                terms,
+                matches,
+                relationsSearched: searched,
+                ...(skipped.length > 0 ? { relationsWithNoSearchableColumn: skipped } : {}),
+                coverage,
+                // Absence is a claim, not a default for an empty array.  Only an
+                // exhaustive, error-free scan of the approved scope may support it.
+                ...(matches.length === 0 && complete
+                    ? { absence: 'not_found', note: 'Searched the approved columns and found no match for these literals.' }
+                    : {}),
+            };
+        },
+    };
+}
+//# sourceMappingURL=value-probe.js.map

package/dist/agentic/value-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"value-probe.js","sourceRoot":"","sources":["../../src/agentic/value-probe.ts"],"names":[],"mappings":"AAkCA,yEAAyE;AACzE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,GAAG,g7BAAg7B,CAAC;AACj8B,4EAA4E;AAC5E,MAAM,QAAQ,GAAG,WAAW,CAAC;AAE7B,8EAA8E;AAC9E,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU;IACvE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ;IACpE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAC1E,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC5C,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU;CACpD,CAAC,CAAC;AACH,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC5C,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK;CAC1C,CAAC,CAAC;AACH,0EAA0E;AAC1E,qEAAqE;AACrE,yEAAyE;AACzE,4EAA4E;AAC5E,kBAAkB;AAClB,MAAM,qCAAqC,GAAG,2EAA2E,CAAC;AAC1H,MAAM,2BAA2B,GAAG,uDAAuD,CAAC;AAE5F,gDAAgD;AAChD,MAAM,eAAe,GAAG,6DAA6D,CAAC;AAEtF,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,GAAG,CACZ,IAAI;SACD,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,WAAW,EAAE;SACb,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,OAAO,CAAC,CACnB,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,MAA2B;IAC7D,MAAM,GAAG,GAAG,CAAC,GAAG,MAAgB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrC,IAAI,qCAAqC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,2EAA2E;IAC3E,yEAAyE;IACzE,oDAAoD;IACpD,OAAO,GAAG,CAAC,GAAG,6BAA6B,CAAC;WACvC,GAAG,CAAC,GAAG,6BAA6B,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAmB;IACnD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7G,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,0BAA0B,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC9C,+EAA+E;IAC/E,8EAA8E;IAC9E,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,0CAA0C;AAC1C,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AAC1C,CAAC;AAED,mFAAmF;AACnF,SAAS,eAAe,CAAC,KAAa;IACpC,4EAA4E;IAC5E,0DAA0D;IAC1D,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,OAAO,IAAI,KAAK,GAAG,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACvD,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,MAAc,EAAE,KAAwB,EAAE,KAAK,GAAG,EAAE;IACvG,MAAM,cAAc,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,cAAc,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACvD,MAAM,IAAI,GAAG,cAAc,YAAY,eAAe,CAAC;IACvD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAClE,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACvD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACzF,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,SAAS,UAAU,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO;QACL,wBAAwB,YAAY,uBAAuB;QAC3D,QAAQ,cAAc,EAAE;QACxB,SAAS,YAAY,qBAAqB,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG;QAC9F,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE;KAC5C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAkCD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA4B;IAChE,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;IAC/C,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,8BAA8B,EAAE,8BAA8B,CAAC,CAAC,CAAC;IAC3I,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,WAAW,EACT,oSAAoS;QACtS,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,CAAC,OAAO,CAAC;YACnB,UAAU,EAAE;gBACV,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,0DAA0D,EAAE;gBAC5H,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,+CAA+C,EAAE;aACtH;SACF;QACD,GAAG,EAAE,KAAK,EAAE,IAAa,EAAE,EAAE;YAC3B,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAA6C,CAAC;YACzG,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;gBACtC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;gBAClG,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,0DAA0D,EAAE,CAAC;YACrG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACrB,oEAAoE;gBACpE,sEAAsE;gBACtE,2DAA2D;gBAC3D,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,2JAA2J;oBACnK,OAAO,EAAE,EAAE;oBACX,QAAQ,EAAE;wBACR,OAAO,EAAE,CAAC;wBACV,MAAM,EAAE,UAAU;wBAClB,UAAU,EAAE,gBAAgB;wBAC5B,gBAAgB,EAAE,CAAC;wBACnB,kBAAkB,EAAE,EAAE;wBACtB,iBAAiB,EAAE,EAAE;wBACrB,+BAA+B,EAAE,EAAE;wBACnC,kCAAkC,EAAE,EAAE;wBACtC,eAAe,EAAE,EAAE;wBACnB,gBAAgB,EAAE,EAAE;qBACU;iBACjC,CAAC;YACJ,CAAC;YACD,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;gBACvD,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC7H,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,GAAG,CAAC;gBAC1C,CAAC,CAAC,IAAI,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;gBACvE,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACrG,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC9G,MAAM,OAAO,GAAkE,EAAE,CAAC;YAClF,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;YAC1C,IAAI,gBAAgB,GAAG,CAAC,CAAC;YACzB,IAAI,sBAAsB,GAAG,KAAK,CAAC;YACnC,IAAI,mBAAmB,GAAG,KAAK,CAAC;YAChC,IAAI,mBAAmB,GAAG,CAAC,CAAC;YAC5B,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACzC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;oBAAE,SAAS;gBACrE,IAAI,mBAAmB,IAAI,YAAY,EAAE,CAAC;oBACxC,sBAAsB,GAAG,IAAI,CAAC;oBAC9B,MAAM;gBACR,CAAC;gBACD,mBAAmB,IAAI,CAAC,CAAC;gBACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACrE,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;oBAC1B,IAAI,gBAAgB,IAAI,gBAAgB,EAAE,CAAC;wBACzC,mBAAmB,GAAG,IAAI,CAAC;wBAC3B,MAAM;oBACR,CAAC;oBACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBACtE,IAAI,CAAC,GAAG,EAAE,CAAC;wBACT,4DAA4D;wBAC5D,4DAA4D;wBAC5D,gCAAgC;wBAChC,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;wBAC5C,SAAS;oBACX,CAAC;oBACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBAC5E,gBAAgB,IAAI,CAAC,CAAC;oBACtB,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;wBAC1C,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;6BAC/B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,GAA+B,EAAE,KAAK,CAAC,CAAC;6BACrF,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;wBACjE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;4BAAE,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;oBACpG,CAAC;oBAAC,MAAM,CAAC;wBACP,sEAAsE;wBACtE,6DAA6D;wBAC7D,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBACzC,CAAC;gBACH,CAAC;gBACD,IAAI,mBAAmB;oBAAE,MAAM;YACjC,CAAC;YACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,KAAK,CAAC;mBACzC,eAAe,CAAC,IAAI,KAAK,CAAC;mBAC1B,OAAO,CAAC,MAAM,KAAK,CAAC;mBACpB,oBAAoB,CAAC,IAAI,KAAK,CAAC;mBAC/B,CAAC,sBAAsB;mBACvB,CAAC,mBAAmB,CAAC;YAC1B,MAAM,MAAM,GAA6B,gBAAgB,CAAC,MAAM,GAAG,CAAC;gBAClE,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,mBAAmB,IAAI,sBAAsB;oBAC7C,CAAC,CAAC,kBAAkB;oBACpB,CAAC,CAAC,QAAQ;wBACR,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,SAAS,CAAC;YAClB,MAAM,QAAQ,GAAyB;gBACrC,OAAO,EAAE,CAAC;gBACV,MAAM;gBACN,UAAU,EAAE,gBAAgB;gBAC5B,gBAAgB;gBAChB,kBAAkB,EAAE,kBAAkB;gBACtC,iBAAiB,EAAE,QAAQ;gBAC3B,+BAA+B,EAAE,OAAO;gBACxC,kCAAkC,EAAE,CAAC,GAAG,oBAAoB,CAAC;gBAC7D,eAAe,EAAE,CAAC,GAAG,eAAe,CAAC;gBACrC,gBAAgB;aACjB,CAAC;YACF,OAAO;gBACL,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAC7B,KAAK;gBACL,OAAO;gBACP,iBAAiB,EAAE,QAAQ;gBAC3B,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,+BAA+B,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3E,QAAQ;gBACR,iEAAiE;gBACjE,oEAAoE;gBACpE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ;oBAClC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,sEAAsE,EAAE;oBACxG,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/analytical-frame.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analytical-frame.d.ts","sourceRoot":"","sources":["../src/analytical-frame.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAwE,KAAK,yBAAyB,EAAiC,MAAM,0BAA0B,CAAC;AAC/K,OAAO,EAAwB,KAAK,sBAAsB,EAAE,KAAK,sBAAsB,EAA2B,KAAK,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5K,OAAO,KAAK,EAAE,sBAAsB,EAA6B,MAAM,+BAA+B,CAAC;AAEvG;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,IAAI,EAAE,sBAAsB,CAAC;IAC7B,WAAW,EAAE,yBAAyB,CAAC;CACxC,GAAG,yBAAyB,CAoF5B;AA0BD,wBAAgB,iCAAiC,CAAC,KAAK,EAAE;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,QAAQ,EAAE,sBAAsB,CAAC;IACjC,eAAe,EAAE,sBAAsB,CAAC;IACxC,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAC5C,UAAU,EAAE,sBAAsB,EAAE,CAAC;CACtC,GAAG,yBAAyB,GAAG,SAAS,CAsOxC"}
+{"version":3,"file":"analytical-frame.d.ts","sourceRoot":"","sources":["../src/analytical-frame.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAwE,KAAK,yBAAyB,EAAiC,MAAM,0BAA0B,CAAC;AAC/K,OAAO,EAAwB,KAAK,sBAAsB,EAAE,KAAK,sBAAsB,EAA2B,KAAK,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5K,OAAO,KAAK,EAAE,sBAAsB,EAA6B,MAAM,+BAA+B,CAAC;AAEvG;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,IAAI,EAAE,sBAAsB,CAAC;IAC7B,WAAW,EAAE,yBAAyB,CAAC;CACxC,GAAG,yBAAyB,CA8F5B;AA0BD,wBAAgB,iCAAiC,CAAC,KAAK,EAAE;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,QAAQ,EAAE,sBAAsB,CAAC;IACjC,eAAe,EAAE,sBAAsB,CAAC;IACxC,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAC5C,UAAU,EAAE,sBAAsB,EAAE,CAAC;CACtC,GAAG,yBAAyB,GAAG,SAAS,CAsOxC"}

package/dist/analytical-frame.js

@@ -24,7 +24,16 @@ export function projectResolvedAnalyticalFrame(input) {
             ...sourceFrame.metricConceptIds.filter((metricId) => metricId !== sourceFrame.metricConceptIds[0]),
         ])
         : unique(resolvedMeasureIds);
-    const groupedDimensionIds = unique(plan.query.dimensions.flatMap((binding) => binding.status === 'resolved' && binding.qualifiedId ? [binding.qualifiedId] : []));
+    const sourceTimeDimensionId = sourceFrame.timeContext?.timeDimensionId;
+    const sourceTimeIsGrouped = Boolean(sourceTimeDimensionId && sourceFrame.dimensions.some((binding) => binding.dimensionId === sourceTimeDimensionId && binding.role === 'group_by'));
+    const groupedDimensionIds = unique(plan.query.dimensions.flatMap((binding) => binding.status === 'resolved' && binding.qualifiedId
+        // The ordinary RAP query list intentionally carries the time phrase for
+        // binding/audit.  It must not silently turn a V2 time_axis into a
+        // group_by role when the source frame did not request a time-series
+        // output; that changes a current-vs-prior ranking into per-day rows.
+        && (binding.qualifiedId !== sourceTimeDimensionId || sourceTimeIsGrouped)
+        ? [binding.qualifiedId]
+        : []));
     const rankingRequested = Boolean(sourceFrame.ranking || plan.query.order || plan.query.limit !== undefined);
     const dimensions = groupedDimensionIds.flatMap((dimensionId, index) => [
         { dimensionId, role: 'group_by' },